skysight-inc/HackerNews huggingface dataset:
Wait, so Sumo Logic is assuming companies will pay them to analyze their data? Isn't data the secret sauce of any company? Why would companies lift up their skirts? Are they really too lazy/cheap to hire a data scientist?
The way you were talking up the site, I thought the sale price would be $40,000, not $400.

My advice: if you are broke and have no food in the fridge, sell it. If you're doing "okay" financially, keep it. Four hundred isn't enough. I'd be asking for at least $700.
Why are you upset with him, at least he informed people. You should be more upset with an insecure app. A less talkative person would just keep it and use the AWS accounts for bitmining.
Exactly, I am considering this for backup in case of any sort of catastrophic event. Fire, robbery, etc. Events where a bit of money for data retrieval will really be the least of my worries that day (Might it even be possible to get homeowners/renters insurance to cover retrieval costs? Something to consider maybe.)
Justin Frankel: Big Ideas
They said absolutely nothing. Blogging, make great products, and other platitudes are pretty meaningless. I am thoroughly unimpressed.
> We are already doing it ...

Yes, absolutely. It is said that, because of radar, we're the brightest object within several light-years in those wavelengths. Add to that the periodic nature of radar, and we're signaling with an obviously unnatural beacon for anyone willing to listen.

I'm just saying the debate goes on, even though we're providing quite a beacon for anyone interested in detecting signs of semi-intelligent life. :)

> True, but we have always been sending radio signals in space and probably will continue to.

I wouldn't say "always". The first reasonably strong, narrow-band radio signals commenced in the 1920s. Not even 100 years. And we're quickly reducing our EM radiation footprint for economic reasons unrelated to anything resembling policy.

I see the point of both arguments -- that we should, and shouldn't, broadcast our existence. I actually prefer the "should" argument overall, considering the difficulty that an alien species would have getting here. We might learn something remarkable from a safe remove.
Here is Frankel's own TL;DR:

>"TL;DR: Ideas are worth a lot to society, but not much to individuals. Execution is the opposite.

Finally, some advice for anybody who wants to make things and profit from them: figure out something you can contribute; ideas aren't enough. If you're content to just contribute to society: publish your ideas, let people use them, and hope for the best."
Thanks!, Your comment made me google Hammer-Brown, and now I want to read that book :)
Http://www.yrm.org/halleluyahstudios.htm
Post hoc ergo propter hoc ?
I am a big fan of one point u just mention "SMB aren't serving themselves" for the groupon livingsocial like products.

I think "serving themselves" is the first step to really help them to boost their business, which must be very non-tech friendly, so that they can understand what happen there and trust the product.

The sales innovation I think might be the most challenging part, since there is almost no virality between SMB. Maybe an accurate sales targeting on the tech early adopters among them could be a potential solution, just like the accurate ad for consumers.
Heh. Having some fun browsing around.

Some of the recordings are better than others. I think the Gotye cover (Mademoiselle Igor - Quelqu'un que j'usais de connaître (Gueautiaient)) is the best I've heard so far.

Gotye: http://www.pardon-my-french.fr/songs/Mademoiselle%20Igor%20-...
it ruins your hipster cred.
Worldcam: Website Lets You Peek Into Any Building
>"How does that make you feel"

Mu.

Obviously it's dead simple to guess the 'correct' answer.

But wrapping it in a faux test of one's humanness is an off-putting premise, that can come across morally condescending (which probably wasn't the intention).

While I support civil rights and the group behind it is probably well intentioned, it doesn't follow automatically that this instance of execution is a good idea.

Also, it's probably fallacious to assume only 3 emotions (or any at all for that matter), are occurring in the user.

"meh", "bored" or "mildly annoyed" etc, are perfectly valid answers too, and does not mean we are jerks for feeling that way :p
>or at least not the ones that actually believe what they say //

I thought the point of trolling was to say things [that you didn't necessarily believe] simply to provoke an emotional or forceful response from the reader.

If you believe it you're not trolling; possibly flame-baiting?
Perhaps you could offer a service where everyone saves their files under your corporate account. When 1 person needs to restore, it will mostly fit within the free download % of the total. So if 10 people store 1 TB each, you can download 500GB/month for free. It's like insurance. We all pay a small amount to cover when one person has a problem.
The key to enjoying any endeavor is working SMART. I love to code, but I also love not to code. The right mix of hard work and 'laziness' should keep great programmers enthusiastic and sharp way past 56!
Is there some sort of source on this graph or is it a prove-a-point type thing. Just wondering, because if there was some way to measure quality of posts over time (up/down vote ratio?) that would be a really neat metric.
Whether you have two 128-bit hashes or one 256-bit hash, you're still trying to fit 2^n pigeons into (2^128)*(2^128) = 2^256 pigeonholes.

Maybe your intuition is telling you that two hashes must be more secure because if one of the two hash functions turns out to be easy to break, then at least you will still be protected by the other?
> Your parent comment implies they would have an "energy alternative" to... energy.

No, not at all. A walking alternative is bicycling, not being a double amputee. A coffee alternative is tea, not dehydration.

"Energy Alternatives":

http://www.energyalternative.com/home.html

Wikipedia: Alternative Energy:

http://en.wikipedia.org/wiki/Alternative_energy

A quote: "Alternative energy is an umbrella term that refers to any source of usable energy intended to replace fuel sources without the undesired consequences of the replaced fuels."

"The energy alternative":

http://www.theenergyalternative.com/

"Alternative Energy News":

http://www.alternative-energy-news.info/

> What "energy alternatives" are you talking about?

Want more links?
Two other suggestions would be:

1. Test how your VPS comes back after a reboot. When you make big changes and at least every 6 months due to all the upgrading that ubuntu does by default it can break the bootup process and you won't know until that emergency unscheduled reboot at 3AM.

2. As long as you're customizing the firewall you should block pings entirely.

* Really, since the distributions are very compatible I would urge you to consider a distro that has selinux enabled by default. Fedora Core is a great place to start. It also has better tools to manage security and gives you good resume skills.
Camille Paglia on industrial design and how capitalism can save art
Any reason why I'm being linked to adds for an ultrabook?
Sailor, or pilot?
Never Give Your Information To 10 Minute Old Startups
s/blur/xkcd/

http://www.wolframalpha.com/input/?i=xkcd+plot+of+sin(x)

I'll be back in two weeks to click that link :-)
I'd be interested in seeing a service like this but for professional photographers. A friend of a friend is a wedding photographer. The work flow for something like this is to have multiple shooters each taking ~25GB worth of photos for one shoot. Then they process the worthy photos, making 3 large files per photo (RAW, .psd, and a final .png). During the turnaround time between wedding and delivery, it would be ideal to keep a copy of each of these files somewhere, but at least keeping the RAW somewhere safe is a minimum requirement. We were trying to figure out a feasible backup solution for the volume of data that such a shoot would require. The time to upload this data is longer than the delivery time for the photos, given the current available upstream bandwidth.

We came to the conclusion that putting files on BluRay disks or hard drives and keeping them physically separate was the best solution for the cost. The problem is that disks take a long time to burn, and external hard drives aren't the best archival medium (not to mention they don't always travel well).

Has anyone here solved the problem of data backups where bandwidth limits make pure online/cloud storage infeasible?
I'm wondering if their server is just overloaded. It's like when you zoom in using Google Maps, the map tiles get a quick ugly resize, then get replaced as more detailed data is downloaded. At least for me, trying these flash photos, zooming in is immediately unclear and nothing ever replaces them with clearer. I suspect it's just server problems, though.
A 3D game company should hire him so we can walk around inside those things. :)
element14 is always on backorder, but that doesn't mean you'll need to wait. They make 4000 rpi boards per day.
I'm shocked at the security flaws in this system. It's so easy to prevent..
My personal favorite is Eta Carinae which could be 20 times the size of Betelgeuse and may be big enough to be a hypernova. It may explode in our lifetimes. Pretty pictures at http://en.wikipedia.org/wiki/Eta_Carinae
Learning Objective C – Day Seven
Please read my comment again :)

You can find a security hole and report it. That's nice and good behavior. But when you say "I have compromised the data with me", then you are being evil.

I signed up to the app because I liked the idea and wanted to support them. I knew that their app was in alpha stage yet.

I'm upset about his behavior.
I'm upset that his behavior might hurt 2 nerds' inspiration.

I'm not upset about he got my keys.

But you are right. His behavior is still better than not saying anything.
Really?
I'm sorry about your experience but mine was completely different, I scheduled my interview in the embassy in Mexico City and I just had to wait 1 week. It was a 2 day process, first I went to a CAS and they captured my biometric information, the next day I went to the interview with the consul which was like 15 minutes or less (but I had to wait for 2 hours), he only took a look at my employer's offer letter and asked for my cedula profesional and that was it. I got my TN visa 1 week later.
then you may wish to remove that email from your profile.
Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.
I did a research on this a while back. Looking at most domains sold at Flippa and other domain sale sites, the final price is closer to the max you can earn in one month x 24 months.
My response was really meant to be addressed to chmike, I put it as a response to your post only because you claimed, like so many others here do, that all that matters are facts not "authority" (which you do call out) or "tone/style", which you don't specifically call out but is also a classic theme in these kind of discussions. Your response does fall squarely under the umbrella of my original advice though, I am not sure if the irony was intended or not. Your accusation of use of a straw man seems to also imply you view this as a debate instead of a discussion, which is sad but not uncommon.
Is that a Ubuntu only tool? I'd be hesitant to commit myself to anything that runs in a single distribution if I can help it. Fail2Ban would work if I decided to migrate to Centos later down the line. https://help.ubuntu.com/community/UFW
Just to be clear: you are agreeing with your parent poster. Here's your response: Facebook's value IS lock-in, and companies with real technical prowess will fail because they rely on producing something new.
> I'm upset about his behavior. I'm upset that his behavior might hurt 2 nerds' inspiration.

I'm hoping they're inspired to write secure code from line one.
Wow. That's taking the idea of an MVP a little too far. Just goes to show worth doing a little research before handing over any real information to a new service like this.
It's massively important that people bring security issues into the open. Talking about these things creates pressure on developers to build secure web apps. Not talking about them because people like you get 'upset' about "hurting 2 nerds' inspiration" means we get poor information security policies all over the Internet.

As it stands we don't know whether hostile agents (silently) got copies of the AWS keys of every user on the site. That should be incredibly concerning for you, but apparently it's not.
I like these, but it doesn't really work this time.

The problem is that their idea won't work. "emotions" is too small a search space. A spam bot could just answer "terrible" to every question and still send a good amount of spam.

reCaptcha works because there are a lot of words in English and a lot of source material that needs to be digitized. That makes it infesible to guess one word, let alone two words at the same time.

This emot-i-captcha requires a human to come up with an unbounded number of unique questions and answers, which is impossible.
But you still should let your users know that their old keys have been compromised.
Was wondering how it was "compromised", thanks for posting this.
In someway I think we agree when you say "project managers, are, by definition, NEVER at the top"

What I am saying is, that when they do reach the top, and in many many organization they do, they use the same skill set that helped them become very good project managers to lead an organization, and manage the future of its products
And as you said, by definition this doesn't work

What I am also saying, which is very sad, many organization structure their performance evaluation process around favoring Project Managers and eventually pushing them to the top
TFA: https://github.com/adobe/brackets/downloads

Has builds for OSX and Windows.
It might be time for pg and co. to reconsider the idea that engineering doesn't matter and that startups are just about people. This is pathetic.
http://html.adobe.com/edge/code/

This is Adobe's branded preview with their extensions, and just2n has supplied the Brackets builds.
About Tig Notaro
To be fair, the guy who owns that site did mention that it wasn't meant to be picked up by HN and was still in the early stages of development.
In addition to the questionable morals of such a system, I think it is technically flawed.

Most captchas work because the words they present to users are mostly random assortments of letters. This one, however, presents real dictionary words. It is pretty conceivable that a bot, armed with a dictionary file, would have a pretty high rate of success correctly identifying at least one of the three words.

If it then randomly chooses one of the identified words, it would have a rate of success at solving the captcha nearing 33%. This is extremely high when your bot is trying to solve thousands of captchas per minute.
> I don't think I've encountered a site that had accounts edited this way before.

Any site that employs the pattern of specifying user account routes using the user's primary key in the URL needs to implement authorization. This site clearly skipped that step.

To me, this looks like the stereotypical bare-bones rails deployment by a newbie.
The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.
Metcalfe's law. This is really pretty valuable though. Not many people are likely to hang around on an empty social network no matter how great the UI.
Personally I'm pretty fed up with Facebook, but living abroad it is still quite simply the easiest way for me to stay in touch with a lot of my friends.
If it's accessible on the public internet and asks for something as secure as API keys, that is when you should worry about security, not when it's "meant to be picked up by HN".
I took a look at the team. Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this?

It looks like this was just the default Rails resource scaffolding.
Perhaps you're misunderstanding my course of action.

1. I didn't disclose how to do it, merely that it was possible.

2. By "get" I in no way mean harvested. I just manually incremented the ID in the URL by hand in my web browser to see how many users could be affected.

3. Since I never saved any of the information (just viewed the pages) I no longer have it since the flaw was patched.

Nothing malicious was done.
That's debatable. It's kind of like banning meth: people want it anyway, so they blow up suburban houses trying to make it. If they could just buy it at CVS, there would be more methheads but fewer meth labs. It's all about how you want to tune the numbers, and the same applies to tweeting while driving. (Twitter on the speedometer: less distraction, more temptation. Twitter not on the speedometer: less temptation, more distraction. Both are bad.)
> Is it considered apropos to state how surprised you are that developers who come across as relatively senior are capable of making an incredibly fundamental security mistake such as this?

Only if you're concerned that you can't tell who is "relatively senior." In this case, your judgement was unfortunately wrong.
PHP has a large number of frameworks that serve the same purpose as Rails. I'm fond of both Rails and CakePHP, and while there are differences between the two, talking about how "Ruby" avoids messy code by forcing MVC onto people but "PHP" doesn't is silly.
How Steve Jobs Handled Antennagate (what Tim Cook should have done)
I have mixed feeling about this.

On one hand we all want to move quickly, get users, add new features, etc etc.

On the other, security issues like this are just so vital that nothing else really matter if your data is not secure. It's especially true for a BACKUP SERVICE that promises ridiculous stuff like "99.999999999%" uptime on the frontpage.
I would recommend using CanCan for security if they haven't done so already so you can't just type in other users user_id in the url to view or edit.
https://github.com/ryanb/cancan

Cancan is great way to make sure that you can only read or edit your own records in the database with Rails.
You just need a director that opens and closes the doors at the right moments.
Wasn't Microsoft Research working on a technology similar to the 'hyperphoto'? It collated numerous photographs of the same location and allowed the viewer to navigate through multiple dimensions of the space.
You're so right! Writing secure web apps is for pussies.
If anything, he did you a favor. You're probably going to create new keys now, whereas you might have written it off as a hypothetical vulnerability otherwise.
we hope to get to that very soon!

most likely, we'll just keep a small data center. something to get around the bandwidth limitation and availability. we would definitely need to charge then in order to cover those costs.
Thank you, yes I'm aware of these. I was trying to focus on the fact that the person who found this security hole used it to get some of this data to himself. But apparently I wasn't clear enough.

I'm still trying to improve my English. Next time I'll try to be more clear. Thank you.
Is GigaMoon.com a scam? They charge startups $249 and there is no refunds
Dude... this guy clearly doesn't understand security. I'm glad you're trying to help him out... but your time will be better spent elsewhere.
I'm puzzled. For the kind of service they want to offer, to have such newbie security vulnerabilities makes you wonder if it even works.
It's the kind of flaw that any moderately experienced developer never leaves opened.
Sorry, I think I misunderstood your comment. I thought you saved some info to yourself.

I'll update my comment above.
if anyone else is having problems viewing this: it's a serious hole in icebox, the service featured here http://news.ycombinator.com/item?id=4619132

if you've used that service, the information you entered was publicly visible (key to access aws, etc) (the thread linked above says it has now been patched).

[i don't understand why, but when i access the link for this thread i get the gzipped page as a download; linux + chrome 22; firefox displays what appears to be gzipped data; wget saves the gzipped data as index.html; same behaviour for chrome on opensuse and ubuntu; windows 7 + ie9 (in a vm) shows the gzipped data in notebook; is no-one else seeing this?!]

[update: fixed now - it looks like it wasn't changing the content type]
Fair, but in any case, the ultimate responsibility still lies with the user's judgment.

Maybe if there was a service promised but not rendered, could you place full blame on the developer(s).
Sumo Logic provides easy tools that allow data analysts (vs. data scientists) of it's customers analyze the data. Sumo Logic never sees the data.
Cancan probably wouldn't have prevented this. It's not because someone didn't use some library. The developer probably just did a User.find(params[:id]) instead of doing something like current_user from whatever authentication system they were using. He probably used the scaffolding generator to make everything and forgot to go back and ensure things are secure.

It's also interesting that the aws key/secret are "masked" on the page, but you can just visit http://www.iceboxpro.com/users/12.json and get the formatted json representation with no masking.
These bikes have integrated locks so that between endpoints you can attach it to any solid post and it will be safe. If you wanted to carry around your own chain-lock you could accomplish the same thing with any bike-sharing bike.
Creating more gender balance in IT at ThoughtWorks
Most racism is an directed form of bullying. When the attacker feels weaker, the result is passive aggressive otherwise it's plain just aggression.
It is equally likely an advanced civilization would have found out ways to engineer/create energy unlike how we imagine it. It might even seem irrational to us, magical, impossible even.
What OS/Browser are you using?
It's a reference to the notion of Eternal September, from usenet lore. To summarize from memory perhaps incorrectly, usenet used to be great but get worse qualitatively when school would start in September. Its quality would increase throughout the year as people learned to communicate appropriately. One year, however, it just never got better...
Just buy a cheap bike and leave it at the Embarcadero bike storage area. It's something stupid like 3 cents an hour. http://bartbikestation.com/
Let's see what the tell-tale signs are (as described):

* "general attitude to their current project"

* "pushing back against work requests"

* "attitude that doesn’t gel with the general ethos the team is aiming for"

* "it’s a developer who doesn’t get involved with the daily meetings"

All these also could point to a messed up crazy work environment where "work requests" are unreasonable, with stuff like "ticket #345 - implement flux capacitor". Anyone not pushing back against such things is either stupid or desperate.

Daily meetings? There another problem. That's enough to turn good people who want to work and concentrate on a problem into being "negative". Make them have daily meetings, morning and afternoon, for good measure.
Am I the only one getting a download.gz file?